Red Hat Bugzilla – Bug 152846
CAN-2004-1002 pppd Remote Denial of Service
Last modified: 2008-05-01 11:38:06 EDT
04.44.13 CVE: Not Available
Title: pppd Remote Denial of Service
Description: pppd is vulnerable to a remote denial of service
condition due to a failure of the application to properly handle
invalid input. pppd version 2.4.1 is knwown to be vulnerable.
------- Additional Comments From email@example.com 2004-11-09 16:24:21 ----
Red Hat Bugzilla:
This bug has been closed as "NOTABUG" by Red Hat Bugzilla.
But, fixed in updates in rpm ppp-2.4.2-5.2.FC2.
------- Additional Comments From firstname.lastname@example.org 2004-12-10 09:50:04 ----
the reason it was NOTABUG for fc1 is that it looks like you can only DOS yourself:
Date: Tue, 2 Nov 2004 10:12:30 +1100
From: Paul Mackerras <email@example.com>
To: Luke Macken <firstname.lastname@example.org>
Cc: email@example.com, firstname.lastname@example.org,
Subject: Re: [ GLSA 200411-01 ] ppp: Remote denial of service vulnerability
Luke Macken writes:
> The pppd server improperly verifies header fields, making it vulnerable
> to denial of service attacks.
> An attacker can cause the pppd server to access memory that it isn't
> allowed to, causing the server to crash. No code execution is possible
> with this vulnerability, because no data is getting copied.
Furthermore, only the connection to the attacker will be affected,
since a separate pppd process handles each ppp connection. In other
words, an attacker can terminate their own connection, but they can
not affect any other connection, or prevent new connections from being
established. Given that, I don't think that this is even a DoS
------- Additional Comments From email@example.com 2005-02-15 07:02:46 ----
Given the above and the fact that we already have a lot of pending updates on
our plate, I'm closing this as WONTFIX.
------- Bug moved to this database by firstname.lastname@example.org 2005-03-30 18:29 -------
This bug previously known as bug 2262 at https://bugzilla.fedora.us/
Originally filed under the Fedora Legacy product and Package request component.
Unknown priority P2. Setting to default priority "normal".
Unknown platform PC. Setting to default platform "All".
Setting qa contact to the default for this product.
This bug either had no qa contact or an invalid one.